Electronic systems such as computers frequently support automatic recordation of events in the form of a message log in order to provide an audit trail for diagnosing problems or monitoring events. When such systems are networked, the number, size, and variety of messages may cause the log to consume storage space rapidly. In order to reduce the amount of storage space required, the log may be stored in archive form. Archives are compressed for storage purposes. Ideally, the user should be able to readily monitor current or recent events and have access to a lengthy history of messages recorded in the archived log.
One approach for archiving messages utilizes a database. Although the database may facilitate data mining and extensive analysis of messages, database archival adds another layer of complexity when users merely want to review recent events.
Another approach logs events in an uncompressed active log. Although the uncompressed active log is readily viewable, the user must manually create an archive when the active log becomes too lengthy. Thus in order to efficiently preserve a history of events, the user must initiate the archival process manually. Aside from the manual archival, this ad hoc approach can result in inadvertent consumption of large amounts of storage unless the user diligently monitors the size of the log.
Yet another approach initiates automatic archival at periodic intervals. This approach can be problematic as well. If the interval is too short, then performance may suffer. If the interval is too long, then excessive amounts of storage space may be consumed in the interim. The unpredictable nature of network activity complicates selection of an archiving interval that keeps the length of the log manageable without archiving too frequently.